Worst Experience - Microsoft Account Recovery Experience

I am posting this because I have now had two Microsoft account recovery cases closed without my account being recovered, despite being able to provide an extraordinary amount of evidence that I am the legitimate account owner.

My Microsoft account was compromised on [--PII REMOVED--]. Within minutes, Microsoft sent notifications showing:

• Password-reset activity on the account.
• My long-standing recovery email was removed.
• My secondary recovery email was removed.
• Microsoft Authenticator on my Android device was removed.
• I then lost access completely.

My original sign-in address now reports that the Microsoft account does not exist, which strongly suggests the attacker changed the primary alias.

The following day, recurring billing on my Microsoft 365 Family subscription was also disabled.

I have provided Microsoft with substantial ownership evidence, including:

• Microsoft account correspondence dating back to [--PII REMOVED--].

An original Microsoft email from [--PII REMOVED--] explicitly identifying my historical Microsoft account and sending the verification to my long-standing Gmail address.

• Microsoft security emails spanning many years.
• Historical sign-in IP addresses supplied by Microsoft themselves.
• Microsoft 365 Family subscription history going back several years.
• Exact Microsoft order numbers.
• Exact purchase dates and amounts.
• PayPal payment history.
• Cardholder name and last four digits of the linked payment card.

The actual Microsoft-generated security emails showing my legitimate recovery methods being removed during the takeover.

A consolidated evidence document containing the relevant records.

I have also spoken directly with Microsoft Support. The support agent confirmed that the recovery request had been escalated to the Microsoft Account Safety Team, and yet the case was closed.

I submitted another recovery request with additional information, that case has now also been closed also.

The response is essentially that the information supplied "does not match our records or is incomplete", with no indication of what information is supposedly incorrect, what evidence is missing, or any meaningful opportunity to speak with the investigator reviewing the case.

Microsoft clearly has internal records showing:

• the historical aliases on the account;
• the account's security-information history;
• the removal of my legitimate authentication methods;
• the change of primary alias;
• my subscription and billing history;
• years of historical sign-ins;
• and the exact sequence of account changes that occurred during the compromise.

Surely an account takeover where an attacker changes the username and removes every legitimate recovery mechanism is precisely the situation where historical account records should be used to establish ownership.

Instead, the recovery process appears to depend on matching information against an account that the attacker has already modified. I am not asking Microsoft to bypass its security controls. I am asking for a competent human review of the historical records.

At this point I would like someone from Microsoft who can actually access the Account Safety investigation to explain:

• Why two recovery investigations have been closed despite the evidence available.
• Whether the investigators reviewed the account's historical alias and security-info changes.
• How an owner is expected to recover an account when the attacker has changed the primary alias and removed every recovery method.
• What specific additional evidence Microsoft requires that is stronger than Microsoft's own emails, order numbers, payment history, historical IP records and security notifications.
• How I can obtain an actual manual review rather than being sent back into the same recovery loop again.

I have been a Microsoft customer for many years and still have a paid Microsoft 365 Family subscription tied to this account.

The current experience has been extraordinarily frustrating. Microsoft can see the account being taken over, notify me that my security methods are being removed, continue charging me for services on the account, and yet apparently cannot establish that I am the owner when I provide those same Microsoft records back to them.

If anyone from Microsoft can escalate this to someone within the Account Safety team who can genuinely review the historical account records, I would appreciate the assistance. [--PII REMOVED--]